Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint

How it was found

Hello,

I have identified a potential Denial of Service (DoS) vulnerability in the /drafts.json endpoint on try.discourse.org. By submitting large payloads (e.g., ~800,000 characters or more) to create drafts, the server processes the request, returns a 502 Bad Gateway error, but still saves the draft. When multiple such requests (e.g., 9 parallel or sequential drafts with unique IDs) are sent, it causes significant server delays, with response times exceeding 32 seconds, indicating resource exhaustion. This issue allows authenticated users to overwhelm the backend by creating multiple large drafts, potentially disrupting service availability for other users.

Steps to Reproduce: Log in to try.discourse.org with a test account. Intercept a request to create a draft (e.g., using Burp Suite or a similar proxy) at POST /drafts.json. Modify the payload to include a large string in the draft content (e.g., use the large payload from https://github.com/DpaysmX/payload_/blob/main/payload.txt, adapted as a long string in the data or draft field). Submit the request. Observe that the server returns a 502 Bad Gateway error, but the draft is still saved (check the drafts section or via GET requests). Create multiple unique drafts (e.g., 9 new drafts with slight variations to avoid "already editing" errors) using the same large payload. Send these requests in sequence or parallel. Monitor response times: The server slows down, with durations up to 32.108 seconds for subsequent requests.

Creating a draft with the large payload. 502 error but successful save. Sending 8 unique drafts, leading to 32-second response delays. [Attach your video here: {F4933992}

Note: The payload cannot be posted as a message (due to validation), but drafts bypass this, allowing abuse. Sequential numbering or unique keys ensure multiple saves without conflicts.

payload: https://github.com/DpaysmX/payload_/blob/main/payload.txt

Impact

This vulnerability enables an authenticated attacker to:

Send large payloads that are processed and saved despite 502 errors, consuming backend resources. Create multiple drafts in quick succession, causing server-wide delays (e.g., 32+ seconds per request). If automated (e.g., via scripts with multiple accounts or IPs), this could lead to resource exhaustion, making the forum unresponsive for legitimate users. Potential for amplified attacks in shared environments, affecting unrelated endpoints and users.